Occupations · Computer and Mathematical

Digital Forensics Analysts

Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.

O*NET 30.3 Database (USDOL/ETA) · occupation code 15-1299.06

Software and tools

A dot marks what O*NET flags as in demand.

Amazon Web Services AWS software●Ansible software●Apple iOS●Apple macOS●Bash●Border Gateway Protocol BGP●C●C#●C++●Extensible markup language XML●Go●Google Workspace software●Hypertext markup language HTML●IBM Terraform●JavaScript●Kubernetes●Linux●Microsoft Access●Microsoft Active Directory●Microsoft Azure software●Microsoft Excel●Microsoft Office software●Microsoft PowerPoint●Microsoft PowerShell●Microsoft Windows●Microsoft Windows Server●Oracle Java●PHP●

O*NET 30.3 software skills · hot-technology flag

What this work is actually like

Conditions rated against the average across all occupations — only what makes this job different is listed.

4 / 5Considerable preparation — a four-year degree plus several years in the field.

O*NET 30.3 Job Zones

What kind of person the work suits

Occupational interest profile, rated 1 to 7.

Investigative6.1

Conventional6.0

Realistic3.2

O*NET 30.2 occupational interests (RIASEC)

How this job is advertised

The same work is posted under many titles — this is what to search for.

Cyber AnalystThreat AnalystDigital AnalystMalware AnalystSecurity AnalystThreat ResearcherOperations AnalystIncident ResponderCyber Threat HunterCyber Threat AnalystDigital InvestigatorDigital Media AnalystCyber Defense AnalystLegal Digital Analyst

O*NET 30.3 job titles reported for this occupation

Get this as a personal report

The same sourced evidence, recut for the closest published view of your city, state or industry, as a dated PDF.

Free page vs. the $29 report

The page above is a public national reference: it is the same for every reader. The $29 report uses the location or industry you name, states the exact BLS cut used, and packages five decision-focused sections as a PDF. Choose $49 when you need a broader comparison of industries, places, changes and next moves.

$29Occupation reportPay where you are, conditions, preparation, education, what you carry into another job.$49Professional reportAdds two decades of pay, industries, geography, what changed, adjacent occupations and what to study.$99International offerAdds named employers and their actual rates from visa filings, the seniority pay ladder and the cities that hire.

Compare the three reports

What you learn	$29	$49	$99
What it pays in your city and industry	✓	✓	✓
Working conditions, preparation, education	✓	✓	✓
What you carry into another occupation	✓	✓	✓
What this job is called in postings	✓	✓	✓
How pay changed over the years	brief	✓	✓
Where the industry changes the number	—	✓	✓
Where the work actually is	—	✓	✓
What appeared and disappeared in the job	—	✓	✓
How long it takes to become competent	—	✓	✓
Where to move next and what to learn	—	✓	✓
What to study to get in	—	✓	✓
What the same work pays in Britain	—	—	✓
What the same work pays in Canada	—	—	✓
Who hires, by name, and at what rates	—	—	✓
The money ladder by skill level	—	—	✓
Cities that actually sponsor visas	—	—	✓
Sections in the report	5	12	19
Who it is for	If you are deciding whether this work is worth your time.	If you are in the occupation and deciding where to move next.	If you are aiming for an offer abroad.

EmailNameCity or stateIndustry (optional)

What decision are you making? (optional)

No payment is taken now. We reply with a secure payment link.

What changed since 2022

Comparing O*NET release 27.1 (2022-11-01) with 30.3 (2026-05-01). Signs, not colour alone, carry the meaning.

Now listed 48

+Geographic information system GIS systems+Microsoft Active Directory+Microsoft Office software+Computer forensic software+Web server software+Wireshark+Intrusion detection system IDS+Ruby+System testing software+Microsoft Windows+Microsoft PowerPoint+PHP+Microsoft Excel+Platform as a service PaaS

No longer listed 1

−Operating system software

Diff across the O*NET releases held here in full since October 2015, following occupations through merges and retirements. O*NET re-surveys occupations on a rolling cycle, so “no change” can also mean “not re-surveyed”.

O*NET 30.3 related occupations

Also called

Cyber AnalystThreat AnalystMalware AnalystDigital AnalystSecurity AnalystThreat ResearcherIncident ResponderOperations AnalystCyber Threat HunterDigital InvestigatorCyber Threat AnalystLegal Digital Analyst

O*NET 30.3 alternative titles

The same work in Europe

ESCO occupation	ISCO	Match
digital forensics expert	2529.2	exact

Official ESCO ↔ O*NET crosswalk (ESCO Secretariat with USDOL/ETA)

Keep exploring

See labor-market evidence in motion.

Watch short Tamhu stories about pay, growth and how work changes — then return to the source data here.

Watch on YouTube →

Watch this occupation

This job has changed before and it will change again. We'll email you when the data moves — a tool appears, a skill gains weight, the pay distribution shifts. Free, and one click to stop.

Check your inbox — your watch starts only after you confirm.

We send data, not advice. No sharing, no resale. Privacy